Skip to content

Web Service

Technique · ATTACK:enterprise:T1102

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1102",
  "title": "Web Service",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1102",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--830c9528-df21-472c-8c14-a036bf17d665",
  "external_id": "T1102",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:13.915Z",
  "modified": "2026-09-03T19:46:46.483Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "Broadcom BirdyClient Microsoft Graph API 2024",
      "url": "https://www.broadcom.com/support/security-center/protection-bulletin/birdyclient-malware-leverages-microsoft-graph-api-for-c-c-communication"
    },
    {
      "source_name": "University of Birmingham C2",
      "url": "https://arxiv.org/pdf/1408.1136"
    }
  ]
}

Explicit source assertions (56)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0040 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0068ce6b-d7da-4e08-acd6-5fabebc2bf88

Google Cloud APT41 2024

ATTACK:enterprise:S1147 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01e1f755-740d-4744-ac81-4f6300b6c857

ESET EvasivePanda 2024 · Symantec Daggerfly 2024

ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0435981c-4e1c-483f-8eb0-6586179e9c23

Palo Alto Latrodectus Activity June 2024

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08f2da07-4e03-46bd-a3d9-c79ef7dd9a45

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--133dc9d4-f21b-40eb-be0c-6ea82fed2bef

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G0100 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16d59476-9fff-413f-9dbe-5c9e43c3860d

Kaspersky Cloud Atlas December 2014 · Symantec Inception Framework March 2018

ATTACK:enterprise:S1086 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b40e3b0-a862-4c79-a8e6-a008e71f6028

Morphisec Snip3 May 2021

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ebc8fee-78fd-4570-9fcd-060f4213b202

HP RaspberryRobin 2024

ATTACK:enterprise:S0335 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ef0015d-f4ab-49fe-a5b2-89e601ea5cfa

Accenture HyperStack October 2020

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f353039-ceda-4477-8fb5-71742102c89b

DOJ FBI Handala Hack March 2026 · FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

ATTACK:enterprise:S9019 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2065dfc0-837a-4ff0-a929-420d9fa8b2a1

Zscaler PureCrypter JUN 2022

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29552ed5-ecfd-4a97-a6c9-d6da25181e1a

Anomali Rocke March 2019 · Talos Rocke August 2018

ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b39f6fb-691a-41ba-ae56-9c2ec45b70d0

Palo Alto Ashen Lepus DEC 2025

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3024f916-b25c-4dd8-aab3-4d681b335da1

ATTACK:enterprise:T1102.003 → subtechnique-of → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--343f8f2b-39d1-48cb-8787-3a6eeab3ddf9

ATTACK:enterprise:S0635 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3614b421-b869-4b33-a979-0c09f0bc275f

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37c90c95-309c-43f9-aa12-67552d0e8c5c

AI-Mexico-Govt-Breach

ATTACK:enterprise:S0546 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a200957-9a8b-407e-a23f-cea1ef8236e6

Cybereason Molerats Dec 2020

ATTACK:enterprise:C0005 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bdacd96-1c94-4af2-b0b3-d44542c31ccd

ESET Operation Spalax Jan 2021

ATTACK:enterprise:S9044 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d27e5a2-523b-4ddf-bdaa-49c44560e802

Artic Wolf Labs Kali365 Device Code April 2026 · Artic Wolf Kali365 Device Code OAuth June 2026 · FBI IC3 Alert I-052126 Kali365 May 2026 · SpyCloud Kali365 June 2026

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41ba13d1-5681-402e-a847-08b7e7b12f42

FireEye FIN6 Apr 2019

ATTACK:enterprise:S0649 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49543c25-bc04-49ba-820e-aa45546c414f

FireEye Shining A Light on DARKSIDE May 2021

ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e348b41-b607-4227-8734-06ef01d40f27

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:T1102.001 → subtechnique-of → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--508dfa9b-e98a-4fb7-a34b-b74a3a7446d9

ATTACK:enterprise:S0547 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54e5545a-6fdc-4bfe-af74-2c80416ed936

Cybereason Molerats Dec 2020 · BleepingComputer Molerats Dec 2020

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63b1af38-765d-4181-add0-dbd3f31941ff

Proofpoint Bumblebee April 2022

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68a9519f-c65a-451e-9126-5946ac6844c6

Bitdefender FIN8 July 2021

ATTACK:enterprise:S1178 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74ab1575-0934-4344-bfa7-7cf97015d5c5

Kaspersky ShrinkLocker 2024

ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81fcae09-a738-4922-9553-aad21e2b940b

Unit 42 Hildegard Malware

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--870704bf-fa76-413b-a529-b95bbca48771

Proofpoint RedLine Stealer March 2020 · Splunk RedLine Stealer June 2023

ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9094f15c-c60c-4366-8c1b-22f21e1156b8

Google EXOTIC LILY March 2022

ATTACK:enterprise:M1021 → mitigates → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--970635e8-9767-4654-b6ff-e1cd12bc206e

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f3ded7a-feef-4180-b89c-baca3c08f96c

BitDefender BADHATCH Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ffd4ba1-1114-4df9-875c-14cacda87b21

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a23f92a2-b88c-4cb0-b028-1883a5a38377

FireEye NETWIRE March 2019

ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a99df039-f5ee-4060-b3ba-b1224acee970

Check Point APT35 CharmPower January 2022

ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0fee298-25cc-450d-ab7e-a7430c6b3f02

Cisco Ukraine Wipers January 2022 · Crowdstrike WhisperGate January 2022 · Unit 42 WhisperGate January 2022 · Microsoft WhisperGate January 2022 · Medium S2W WhisperGate January 2022

ATTACK:enterprise:S0508 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b110013b-35e5-470e-9e17-470c7071fa80

Zdnet Ngrok September 2018

ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b14227d3-b032-482d-a19a-6dcdc0f10c9c

Secureworks DarkTortilla Aug 2022

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1eec91d-73d9-421d-b271-c7e1753a0c1e

TAG APT42 · Mandiant APT42-charms · Mandiant APT42-untangling

ATTACK:enterprise:S0600 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b94f2e1a-a364-4bf1-af63-f9ce2b7de89b

Intezer Doki July 20

ATTACK:enterprise:T1102.002 → subtechnique-of → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbddae2e-69d5-4b4f-a091-42d12075e007

ATTACK:enterprise:S1221 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc7896a1-8be2-403b-b31d-b7d66104999d

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1b5996f-e0f9-4986-9ee1-c5c9dc85d8e5

Palo Alto Brute Ratel July 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c313b2dd-2f30-408d-aeef-59e41ef38927

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S9015 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6534574-cd90-4390-810d-0392c460e9f8

Google BRICKSTORM September 2025

ATTACK:enterprise:S0561 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cebec7e0-7be7-4bcf-936f-bd7622d559c7

Medium Eli Salem GuLoader April 2021

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d452da85-b408-458f-ad25-937605de4611

ClearSky Pay2Kitten December 2020

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5f0ff09-374d-45f6-b7d8-45466bf0ecf0

Cybereason Bazar July 2020 · Zscaler Bazar September 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0e492ef-c67d-4a02-be8d-2e9a650ea6f0

Accenture HyperStack October 2020 · ESET Crutch December 2020

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eac3f09f-fdd0-4bbd-965b-4e22276f4021

IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025 · Proofpoint TA416 Europe March 2022

ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f68dea79-cd44-4791-bee1-e0650868bd28

SentinelOne SocGholish Infrastructure November 2022

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa7887c3-d49d-4499-9ee4-f9a504ce7dec

ESET Gamaredon June 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fdf8d947-f896-4797-9c6f-00b211a602a6

Volexity Ocean Lotus November 2020

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff4440ce-f6b6-4e59-9333-4f4a3b96a2e4

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff500c79-fa27-4fe3-a3c2-8c5d20031824

Cisco Talos Intelligence Group · Aqua TeamTNT August 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.